[arch-security] [ASA-201506-2] cups: multiple issues
anthraxx at archlinux.org
Wed Jun 10 01:29:59 UTC 2015
Arch Linux Security Advisory ASA-201506-2
Date : 2015-06-10
CVE-ID : CVE-2015-1158 CVE-2015-1159
Package : cups
Type : multiple issues
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package cups before version 2.0.3-1 is vulnerable to multiple issues
including arbitrary code execution, privilege escalation and cross-side
Upgrade to 2.0.3-1.
# pacman -Syu "cups>=2.0.3-1"
The problems have been fixed upstream in version 2.0.3.
- CVE-2015-1158 (arbitrary code execution, privilege escalation)
An issue with how localized strings are handled in cupsd allows a
reference counter to over-decrement when handling certain print job
request errors. As a result, an attacker can prematurely free an
arbitrary string of global scope, creating a dangling pointer to a
repurposed block of memory on the heap. The dangling pointer causes ACL
verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL
handling failure results in unrestricted access to privileged
operations, allowing an unauthenticated remote user to upload a
replacement CUPS configuration file and mount further attacks.
- CVE-2015-1159 (cross-side scripting)
A cross-site scripting bug in the CUPS templating engine allows this bug
to be exploited when a user browses the web. In certain cases, the CGI
template can echo user input to file rather than escaping the text
first. This may be used to set up a reflected XSS attack in the QUERY
parameter of the web interface help page. By default, many linux
distributions run with the web interface activated.
A remote attacker is able to use a cross-side scripting flaw in order to
send a malicious print request that is leading to arbitrary code
execution and privilege escalation.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security